Out-of-App Partner Authentication for Sandboxed Mobile Apps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for secure third-party authentication in sandboxed mobile operating systems are impractical, as they cannot communicate authenticated identities back from the browser to the app, making it difficult to provide partner-specific authentication for multiple partners from a single app.
Innovation Solution
An out-of-app based user authentication system where the app requests a secure session ID from the publisher's identity provider, directs the browser to navigate to the publisher IDP with a partner ID, and then to the partner's IDP for user authentication, allowing the app to receive a secure authentication token for multiple publisher services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional browser-based authentication is used in sandboxed mobile operating systems, then user authentication can be performed, but the app cannot communicate authenticated identities back from the browser to the app
Solution Approach 1:
The patent introduces a notification service as an intermediary component that bridges the sandboxed app and the external authentication system. The notification service receives authentication results from the browser and delivers them to the app through predefined notification channels, enabling secure identity communication without compromising sandbox integrity
Solution Approach 2:
The authentication flow is segmented into distinct phases: (1) app initiates authentication by obtaining a session ID, (2) browser handles the authentication redirect to the partner's IDP, (3) notification service communicates the result back to the app. This segmentation allows each component to operate within its security constraints while maintaining overall system functionality
2Ease of manufacture
If a single app version is distributed from the app store, then app distribution is simplified, but the app cannot provide partner-specific authentication for multiple partners
Solution Approach 1:
The patent implements dynamic configuration where the app can adapt its authentication behavior based on runtime parameters. The app receives a partner identifier and uses it to dynamically construct the appropriate authentication flow, redirect to the correct partner IDP, and handle partner-specific branding and features without requiring separate app versions
Solution Approach 2:
The app is designed as a universal platform that can serve multiple partners through a single version. It incorporates universal authentication mechanisms that can be configured to work with different partners' IDPs, enabling one app to perform multiple authentication functions for different partners simultaneously
3Adaptability or versatility
If the app integrates with multiple third party authentication services, then multi-partner authentication is enabled, but the integration complexity increases significantly
Solution Approach 1:
The notification service acts as a standardized intermediary layer between the app and various partner IDPs. Instead of the app needing to implement multiple different authentication protocols directly, the notification service handles the complexity of communicating with different IDPs through a unified notification-based interface, simplifying the app's integration requirements
Data Source
AI summary
An app runs on a user operated computing device, e.g., a mobile device running a sandboxed operating system. The app requests a session ID from a publisher Idp. The app registers for notifications on the session ID with a notification service. The app directs a browser to navigate to the publisher IdP, and to pass it the secure session ID and an ID of a specific partner. The publisher IdP returns a redirect to a third party IdP used by the specific partner to authenticate users. The browser navigates to the third party IdP, which prompts the user for authentication credentials. The third party Idp uses the credentials to authenticate the user, and redirects the authentication result to the publisher IdP. The publisher IdP sends the app a notification, via the notification service. In response, the app calls the publisher IdP, and receives a secure authentication token.